Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed bug in allowed_workflows logic #1377

Merged
merged 1 commit into from
Jan 31, 2021
Merged

Fixed bug in allowed_workflows logic #1377

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions server/events/yaml/valid/global_cfg.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -292,12 +292,15 @@ func (g GlobalCfg) ValidateRepoCfg(rCfg RepoCfg, repoID string) error {
// default is always allowed
if p.WorkflowName != nil && len(allowedWorkflows) != 0 {
name := *p.WorkflowName
if !sliceContainsF(allowedWorkflows, name) || !allowCustomWorkflows {
return fmt.Errorf("workflow '%s' is not allowed for this repo", name)
if allowCustomWorkflows {
// If we allow CustomWorkflows we need to check that workflow name is defined inside repo and not global.
if mapContainsF(rCfg.Workflows, name) {
break
}
}

if allowCustomWorkflows {
break
if !sliceContainsF(allowedWorkflows, name) {
return fmt.Errorf("workflow '%s' is not allowed for this repo", name)
}
}
}
Expand Down
120 changes: 118 additions & 2 deletions server/events/yaml/valid/global_cfg_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,7 +133,7 @@ func TestGlobalCfg_ValidateRepoCfg(t *testing.T) {
repoID string
expErr string
}{
"repo uses workflow that is defined but not allowed": {
"repo uses workflow that is defined server side but not allowed (with custom workflows)": {
gCfg: valid.GlobalCfg{
Repos: []valid.Repo{
valid.NewGlobalCfg(true, false, false).Repos[0],
Expand Down Expand Up @@ -161,7 +161,123 @@ func TestGlobalCfg_ValidateRepoCfg(t *testing.T) {
repoID: "github.com/owner/repo",
expErr: "workflow 'forbidden' is not allowed for this repo",
},
"repo uses workflow that is defined AND allowed": {
"repo uses workflow that is defined server side but not allowed (without custom workflows)": {
gCfg: valid.GlobalCfg{
Repos: []valid.Repo{
valid.NewGlobalCfg(true, false, false).Repos[0],
{
ID: "github.com/owner/repo",
AllowCustomWorkflows: Bool(false),
AllowedOverrides: []string{"workflow"},
AllowedWorkflows: []string{"allowed"},
},
},
Workflows: map[string]valid.Workflow{
"allowed": {},
"forbidden": {},
},
},
rCfg: valid.RepoCfg{
Projects: []valid.Project{
{
Dir: ".",
Workspace: "default",
WorkflowName: String("forbidden"),
},
},
},
repoID: "github.com/owner/repo",
expErr: "workflow 'forbidden' is not allowed for this repo",
},
"repo uses workflow that is defined in both places with same name (without custom workflows)": {
gCfg: valid.GlobalCfg{
Repos: []valid.Repo{
valid.NewGlobalCfg(true, false, false).Repos[0],
{
ID: "github.com/owner/repo",
AllowCustomWorkflows: Bool(false),
AllowedOverrides: []string{"workflow"},
AllowedWorkflows: []string{"duplicated"},
},
},
Workflows: map[string]valid.Workflow{
"duplicated": {},
},
},
rCfg: valid.RepoCfg{
Projects: []valid.Project{
{
Dir: ".",
Workspace: "default",
WorkflowName: String("duplicated"),
},
},
Workflows: map[string]valid.Workflow{
"duplicated": {},
},
},
repoID: "github.com/owner/repo",
expErr: "repo config not allowed to define custom workflows: server-side config needs 'allow_custom_workflows: true'",
},
"repo uses workflow that is defined repo side, but not allowed (with custom workflows)": {
gCfg: valid.GlobalCfg{
Repos: []valid.Repo{
valid.NewGlobalCfg(true, false, false).Repos[0],
{
ID: "github.com/owner/repo",
AllowCustomWorkflows: Bool(true),
AllowedOverrides: []string{"workflow"},
AllowedWorkflows: []string{"none"},
},
},
Workflows: map[string]valid.Workflow{
"forbidden": {},
},
},
rCfg: valid.RepoCfg{
Projects: []valid.Project{
{
Dir: ".",
Workspace: "default",
WorkflowName: String("repodefined"),
},
},
Workflows: map[string]valid.Workflow{
"repodefined": {},
},
},
repoID: "github.com/owner/repo",
expErr: "",
},
"repo uses workflow that is defined server side and allowed (without custom workflows)": {
gCfg: valid.GlobalCfg{
Repos: []valid.Repo{
valid.NewGlobalCfg(true, false, false).Repos[0],
{
ID: "github.com/owner/repo",
AllowCustomWorkflows: Bool(false),
AllowedOverrides: []string{"workflow"},
AllowedWorkflows: []string{"allowed"},
},
},
Workflows: map[string]valid.Workflow{
"allowed": {},
"forbidden": {},
},
},
rCfg: valid.RepoCfg{
Projects: []valid.Project{
{
Dir: ".",
Workspace: "default",
WorkflowName: String("allowed"),
},
},
},
repoID: "github.com/owner/repo",
expErr: "",
},
"repo uses workflow that is defined server side and allowed (with custom workflows)": {
gCfg: valid.GlobalCfg{
Repos: []valid.Repo{
valid.NewGlobalCfg(true, false, false).Repos[0],
Expand Down